Stats

5808 observations in window.

Traffic

Raw request volume vs visit-deduplicated collection. Requests exclude internal monitoring and operator traffic; observation totals here are preserved after raw observations age out of retention.

Signal coverage

Share of observations carrying each signal. Absence is mostly structural — QUIC (HTTP/3) connections carry no TCP SYN or HTTP/2 frame signal, and HTTP/1.1 connections no HTTP/2 frames — occasionally operational, when a signal source was briefly unavailable or not yet deployed at capture time.

Distinct fingerprints

"New" counts fingerprints first seen inside the window; the link lists them ranked by volume.

Distinct clients per day

Distinct IP-hashes per complete UTC day (chart spans the last 90 days, independent of the window above). A client seen over both transports counts in both columns, so tcp + quic can exceed the total.

JA4 label coverage

Where the window's TLS and QUIC traffic (grouped by JA4, visit-deduplicated observations) gets its application labels. Measured fingerprints match this site's own controlled-capture catalog; JA4+ DB snapshot ones appear only in the static community-database export (frozen upstream — see about); unlabeled ones match neither. Traffic is classified against today's label sources, so growing the catalog moves history too. The highest-volume unlabeled fingerprints below are the capture wishlist: the clients most worth adding to the catalog next.

Top unlabeled JA4s

Bot operator claims

Self-declared bot User-Agents — checked at ingest against the verification channels each operator publishes: its crawler IP ranges, and where the operator documents one, forward-confirmed reverse DNS. Observations is visit-deduplicated volume — roughly one per source and client stack per 10-minute window. A source is a distinct client (keyed IP hash) that claimed the operator in the selected window; legit sources were confirmed by an operator-published channel, spoofed sources by none. Spoof rate is spoofed ÷ all sources — it counts actors, not traffic. Top verified JA4 is the fingerprint the operator's own confirmed traffic most often presented. Counts reflect the selected window (windowed history begins when bot-claim tracking was deployed; all is true all-time; source and fingerprint windows are day-granular). Every supported claim identity is listed; a zero row means no claim was adjudicated in this window, not necessarily that its User-Agent was never seen. Operators that publish only their network rather than crawler ranges (e.g. Meta) are confirmed by network membership; their spoofed column merges soft outside-network misses with any claims from inside a different operator's published crawler range. flagged claims →